Identity Provider Integration

1. Overview

Sentinel Privilege Manager can integrate with an enterprise Identity Provider (IdP) to synchronize users and groups with the privilege management platform.

This integration reduces duplicate user administration and enables administrators to use centrally managed identity information when assigning endpoint privilege policies.

1.1 Benefits

2. Integration Use Case

The example scenario in this guide assumes that an organization already maintains users and groups in an enterprise Identity Provider.

2.1 Example Scenario

The organization wants to synchronize its Engineering, Finance, and Security groups with Sentinel Privilege Manager.

The synchronized groups will later be used to assign endpoint privilege policies.

3. Integration Architecture

The integration consists of the Identity Provider, the SPM integration service, and the SPM management platform.

3.1 Data Flow

1. The integration service authenticates with the Identity Provider.
2. The service retrieves supported user and group attributes.
3. SPM validates the received information.
4. New and updated identities are synchronized.
5. Removed identities are processed according to the configured synchronization policy.

4. Prerequisites

Complete the following prerequisites before configuring the integration.

5. Configure the Integration

Configure the Identity Provider integration from the SPM administration console.

5.1 Connection Parameters

6. Authentication

SPM uses an application identity to authenticate requests to the Identity Provider.

6.1 Example Authentication Configuration

{
    "authentication": {
        "type": "client_credentials",
        "clientId": "spm-integration-client",
        "tokenEndpoint": "https://idp.example.com/oauth2/token"
    }
}
    

6.2 Test Authentication

Use the Test Connection option in the SPM integration configuration page to verify that the configured credentials can authenticate successfully.

7. Attribute Mapping

Attribute mapping defines how identity fields from the Identity Provider are represented within SPM.

7.1 User Attribute Mapping

7.2 Group Attribute Mapping

8. Synchronization

Synchronization transfers supported identity information from the Identity Provider to SPM.

8.1 Synchronization Modes

8.2 Start a Manual Synchronization

8.3 Synchronization Results

9. Validate the Integration

Complete the following validation checks after the first successful synchronization.

10. Troubleshooting

10.1 Integration Logs

Review the integration logs when additional diagnostic information is required.

C:\ProgramData\SentinelPM\Logs\Integration\
    

11. Rollback

If the integration causes unexpected behavior, administrators can disable synchronization while investigating the issue.

11.1 Disable Synchronization

1. Open Administration → Integrations.
2. Select the affected Identity Provider integration.
3. Disable scheduled synchronization.
4. Save the configuration.
5. Review existing synchronized records and determine the appropriate remediation.

12. Integration Best Practices

• Use dedicated integration credentials rather than personal administrator accounts.
• Store secrets in an approved secrets management system.
• Grant only the permissions required for synchronization.
• Test the integration with a limited synchronization scope before production rollout.
• Monitor synchronization results and investigate repeated failures.
• Document changes to attribute mappings and synchronization filters.
• Maintain a rollback procedure for integration changes.
• Review integration credentials and certificates according to organizational security requirements.

Document Information